Features

rkcheck provides the tool name rkscanmal that can:

1. Scan files
2. Scan process's memory
3. Find user-land rootkit's library using function's address comparison

Developed as "as effective as possible" in mind, rkscanmal engine has features:

1. Support both Yara signatures (either cleartext or compiled rules) and ClamAV signatures.
2. Collect various information of a running process (from ProcFS) so scan a process is not limited to string scan, but can perform more heuristic detection like reverse shell, thread masquerading or self delete malware